<?php

include_once "function_xml_basic.php";
include_once "function_xml_atom.php";
include_once "function_obj_analyse.php";

$root_path = "/MINI/SECURITY/POLICY/NATS";
$iptables = "/usr/local/bin/iptables -t nat ";

function GetXmlSecNatByName($name)
{
	$ret_array = GetXmlSecNatList();
    
        foreach ($ret_array as $ret)
        {   
                if ($ret['Name'] == $name)
                        return $ret;
        }   
        return NULL;

}

function GetXmlSecNatList()
{
	global $root_path;
	$query_string = $root_path. "/NAT";
	$key_array = array("Name", "InDev", "OutDev", "SrcAddr", "DstAddr", 
			   "DstPort", "SrcPort",  "Proto", 
			   "CvtSrcPort", "CvtDstPort", 
			   "CvtDstAddr", "CvtSrcAddr", 
			   "NatType", "Enabled");
	return GetAttributList($query_string, $key_array);
}
/*
$ret_list = GetXmlSecNatList();
foreach ($ret_list as $ret)
{
	print $ret['Name'];
}
*/

function GetXmlSecObjcetNameList()
{
	$name_list = array();
	$temp_array = GetXmlSecObjectList();
	
	$i = 0;
	foreach ($temp_array as $tmp)
	{
		$name_list[$i ++] = $tmp['Name'];
	}
	return $name_list;
}

function GetXmlNumberSecNats()
{
	global $root_path;
	$query_string = $root_path. "/NAT";
	return GetNumberOfNode($query_string);
}

function GetXmlSecObjectContentList($name)
{
	$object = GetXmlSecGroupByName($name);
	$tmp_string = $object['ObjectList'];
	$list = explode(',', $tmp_string);
	#foreach ($list as $i)
	#	print "[". $i. "]\n";
	return $list;
}

function DelXmlSpecialOneSecNat($name)
{
	global $root_path;

	$query_string = $root_path. "/NAT[@Name='". $name. "']";
	DelSpecialNode($query_string);
	ApplySecNatRule();
}

function AppendXmlSecOneNat($in_array)
{
	global $root_path;
        $node_name = "NAT";
	$query_string = $root_path;
	$in_array['Type'] = "1";
	AppendAllAttrOfNode($query_string, $node_name, $in_array);
	ApplySecNatRule();
}

function InsertXmlSecOneNat($number, $in_array)
{
	global $root_path;
	$node_name = "NAT";
	$query_string_from = $root_path. '/NAT['. $number. ']';
	//print $query_string_from;
	InsertOneNode($query_string_from, $node_name, $in_array);
	ApplySecNatRule();
}

function SetXmlSecOneNat($in_array)
{
	global $root_path;
	$name = $in_array['Name'];
	$in_array['Type'] = "1";
	$query_string = $root_path. "/NAT[@Name='". $name. "']";

	EditAllAttrOfNode($query_string, $in_array);
	ApplySecNatRule();
}


function MoveXmlOneSecNat($from, $to)
{
	global $root_path;
	$query_string_from = $root_path.  "/NAT". "[". $from. "]";
	$query_string_to= $root_path. "/NAT". "[". $to. "]";
	
	if ($from == $to)
		return SUCCESS;

	$number = GetXmlNumberSecNats();
	
	if ($from > $number || $to > $number)
		return ERR_VALUE;

	if ($from > $to)
	{
		MoveFrontOneNode($query_string_from, $query_string_to);
	}
	else
	{
		if ($to < $number)
		{
			$query_string_to= $root_path. "/NAT". "[". ($to + 1 ). "]";
			MoveFrontOneNode($query_string_from, $query_string_to);
		}
		else
		{
			MoveEndOneNode($query_string_from, $query_string_to);
		}
	}
	ApplySecNatRule();
	return SUCCESS;
}

function DelXmlAllSecNats()
{
	global $root_path;
	$query_string = $root_path. "/NAT";
	DelSpecialNode($query_string);
	ApplySecNatRule();
}

function GetXmlSecGroupByName($name)
{
	$ret_array = GetXmlSecGroupList();
    
        foreach ($ret_array as $ret)
        {   
                if ($ret['Name'] == $name)
                        return $ret;
        }   
        return NULL;

}

function GetXmlSecGroupList()
{
	global $root_path;
	$query_string = $root_path. "/GROUP/OBJECT";
	$key_array = array('Name', 'ObjectList', 'ObjectType');
	return GetAttributList($query_string, $key_array);
}

function SetXmlSecGroup($in_array)
{
	global $root_path;
	$in_array['ObjectType'] = "1";
	$query_string = $root_path. "/GROUP/OBJECT[@Name='". $in_array['Name']. "']";
	EditAllAttrOfNode($query_string, $in_array);
}

function DelXmlSpecialOneSecGroup($name)
{
	global $root_path;

	$query_string = $root_path. "/GROUP/OBJECT[@Name='". $name. "']";
	DelSpecialNode($query_string);
}

function FlushAllSecNatRule()
{
	global $iptables;
	$command = "";
	$command = $iptables. " -t nat -F USERSNAT & > /dev/null; ". $iptables. " -t nat -F USERDNAT & >/dev/null; ";
	$ret = shell_exec($command);
	return $ret;
}

function ApplySecNatRule()
{
	global $iptables;
	
	FlushAllSecNatRule();
	
	$command = "";
	$ret_list = GetXmlSecNatList();

	foreach ($ret_list as $ret)
	{
		$ret_string = "";
		$ret_string = ApplyOneSecNatRule($ret);
        	$command .= $ret_string;
	} 
	//print $command;
	$ret = shell_exec($command);
	return $ret;
}

function ApplyOneSecNatRule($list)
{
	include_once "function_sys_license.php";
	$license = CheckSysLicenseForRule();
	if ($license == FALSE)
	{
		return ;
	}

	if ($list['Enabled'] == 0)
		return ;
	global $iptables;
	/* 
	"Name", "InDev", "OutDev", "SrcAddr", "DstAddr", "DstPort", "SrcPort",  "Proto", 
	"CvtSrcPort", "CvtDstPort", "CvtDstAddr", "CvtSrcAddr", "NatType", "Enabled" 
	*/

	if ($list['InDev'] == '' || $list['InDev'] == 'All')
		$indev = "";
	else
		$indev = " -i ". $list['InDev'];
	
	if ($list['OutDev'] == '' || $list['OutDev'] == 'All')
		$outdev = "";
	else
		$outdev = " -o ". $list['OutDev'];


	$value_temp = "";
	$value_temp = $list['SrcAddr'];
	if ($value_temp == ''|| $value_temp == 'All')
	{
		$srcaddr_temp = array ("IpString" => " ", "IpType" => -1);
		$srcaddr_list = array($srcaddr_temp);
	}
	else
	{
		$srcaddr_list = GetRealNetValueByName($value_temp);
	}

	$value_temp = "";
	$value_temp = $list['DstAddr'];
	if  ($value_temp == ''|| $value_temp == 'All')
	{
		$dstaddr_temp = array ("IpString" => " ", "IpType" => -1);
		$dstaddr_list = array($dstaddr_temp);
	}
	else
	{
		$dstaddr_list = GetRealNetValueByName($value_temp);
	}

	$value_temp = "";
	$value_temp = $list['CvtSrcAddr'];
	if ($value_temp == "nochange" || $value_temp == "")
	{
		$cvt_srcaddr_temp = array("IpString" => " ", "IpType" => -1);
		$cvt_srcaddr_list = array($cvt_srcaddr_temp);
	}
	else
	{
		$cvt_srcaddr_list = GetRealNetValueByName($value_temp);
	}

	$value_temp = "";
	$value_temp = $list['CvtDstAddr'];
	if ($value_temp == "nochange" || $value_temp == "")
	{
		$cvt_dstaddr_temp = array("IpString" => " ", "IpType" => -1);
		$cvt_dstaddr_list = array($cvt_dstaddr_temp);
	}
	else
	{
		$cvt_dstaddr_list = GetRealNetValueByName($value_temp);
	}


	if ($list['Proto'] == '' || $list['Proto'] == 'All')
	{
		$proto = "";
		$srcport = "";
		$dstport = "";
		$str_cvt_src_port = "";
		$str_cvt_dst_port = "";
	}
	else
	{
		$proto = " -p ". $list['Proto']. " ";
		
		if ($list['SrcPort'] != '')
			$srcport = " --sport ". $list['SrcPort'];
		else
			$srcport = "";

		if ($list['DstPort'] != '')
			$dstport = " --dport ". $list['DstPort'];
		else
			$dstport = "";

		if ($list['CvtSrcPort'] == "nochange" || $list['CvtSrcPort'] == "")
		{
			$str_cvt_src_port = "";
		}
		else
			$str_cvt_src_port = ":". $list['CvtSrcPort'];

		if ($list['CvtDstPort'] == "nochange" || $list['CvtDstPort'] == "")
		{
			$str_cvt_dst_port = "";
		}
		else
			$str_cvt_dst_port = ":". $list['CvtDstPort'];
	}

	$command = "";
	$command_snat = "";
	$command_dnat = "";

	foreach( $srcaddr_list as $src)
	{
		if ($src['IpString'] == '')
			continue;

		if ($src['IpString'] != ' ')
			$str_srcaddr = " -s ". $src['IpString'];
		
		foreach ( $dstaddr_list as $dst)
		{
			if ($dst['IpString'] == '')
				continue;
			
			if ($dst['IpString'] != ' ')
				$str_dstaddr = " -d ". $dst['IpString'];
			
			foreach ($cvt_srcaddr_list as $cvt_srcaddr)
			{
				if ($cvt_srcaddr["IpString"] == '')
					continue;

				$str_cvt_srcaddr = $cvt_srcaddr['IpString'];

				foreach ($cvt_dstaddr_list as $cvt_dstaddr)
				{
					if ($cvt_dstaddr['IpString'] == '')
						continue;

					$str_cvt_dstaddr = $cvt_dstaddr['IpString'];

					if ($list['NatType'] == 1 || $list['NatType'] == 3) // S_nat SD_nat
					{
						$command_snat .= $iptables. " -A USERSNAT ";
						$str_snat = " -j SNAT --to ";

						if ($str_cvt_srcaddr == ' ' && $str_cvt_src_port == '')
						{
							$operate1 .= " -j ACCEPT ;";
						}
						else
						{
							$operate1 .= $str_snat. $str_cvt_srcaddr. $str_cvt_src_port. "; ";
						}

						$str_init = $outdev. $proto. $dstport. $srcport;
						$command_snat .= $str_init. $str_srcaddr. $str_dstaddr. $operate1;
						//print "SNAT:". $command_snat. "\n\n\n";
					}
					if ($list['NatType'] == 2 || $list['NatType'] == 3) // D_nat SD_nat
					{
						$command_dnat .= $iptables. " -A USERDNAT ";
						$str_dnat = " -j DNAT --to ";

						if ($str_cvt_dstaddr == ' ' && $str_cvt_dst_port == '')
						{
							$operate2 .= " -j ACCEPT ;";
						}
						else
						{
							$operate2 .= $str_dnat. $str_cvt_dstaddr. $str_cvt_dst_port. "; ";
						}

						$str_init = $indev. $proto. $dstport. $srcport;
						$command_dnat .= $str_init. $str_srcaddr. $str_dstaddr. $operate2;
						//print "DNAT:". $command_dnat. "\n\n\n";
					}
					$command .= $command_dnat. $command_snat;
				}
			}
		}
	}
	//print "\n\n". $command. "\n";
	return $command;
}

?>
